Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 18 JUNE 2026

EU Cyber Resilience Act Countdown: 11 September 2026 Incident/Vulnerability Reporting Deadline Less Than 100 Days Away

Crowell & Moring LLP
Crowell & Moring LLP
Contributor
Crowell & Moring LLP

Crowell & Moring LLP

Crowell & Moring’s Doha office is a full service legal practice that serves as the firm’s regional...

View firm profile
Explore more from Crowell & Moring LLP

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024...

United KingdomStrategy
Lauren Cuyvers
Lauren Cuyvers
Grace Tang
Grace Tang
Eric Montens
Eric Montens

What You Need to Know

  • Key takeaway #1

    The CRA incident and vulnerability reporting requirement formally kicks in on 11 September 2026 – meaning as of that date, companies inside and outside the EU that market connected products in the EU and who become aware of actively exploited vulnerabilities or severe incidents in such products, must report them to the competent authorities within 24 hours.

  • Key takeaway #2

    The CRA is broad in scope, both from a territorial and a material perspective: it applies bothto companiesinside and outside the EU (such as in the U.S.) where their connected products are sold or made available in the EU; and it is a horizontal law that is sector- and industry-neutral — most modern technology today is connected, meaning a large number of hardware and software will be in scope.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

See more popular content from

Article

Preparing For The EU Cyber Resilience Act: Key Reporting Obligations From 11 September 2026

The EU's Cyber Resilience Act introduces mandatory cybersecurity reporting obligations for manufacturers of digital products starting September 2026, requiring notification of actively exploited vulnerabilities and severe incidents within strict timeframes. Companies must establish procedures to identify and report security events to national Computer Security Incident Response Teams, with potential fines reaching €15 million or 2.5% of global turnover for non-compliance.
United KingdomStrategy
Goodwin Procter LLP
Goodwin Procter LLP
Article

European Commission Proposes European Innovation Act

The European Commission has unveiled a European Innovation Act designed to strengthen the EU's innovation ecosystem by addressing two critical challenges: limited access to finance for IP-rich businesses and fragmented regulatory frameworks across Member States. The proposal introduces measures including a common IP valuation framework, streamlined R&D procurement procedures, and harmonized regulatory sandboxes to help startups and scaleups commercialize their innovations more effectively.
European UnionStrategy
Lewis Silkin
Lewis Silkin
Article

The SRA’s AI Warning Notice: A Regulatory Wake-up Call, Not A Reason To Step Back

The Solicitors Regulation Authority has issued a warning notice on AI misuse in legal practice, clarifying what responsible adoption looks like. While recognizing AI's benefits for document review, drafting, and research, the regulator emphasizes that solicitors remain accountable for their work regardless of the tools used, requiring proper governance, human oversight, and professional judgment to manage risks like hallucinated citations and confidentiality breaches.
United KingdomStrategy
Gateley Legal
Gateley Legal
Article

SBA Extends Deadline For Comments On Historic Overhaul Of Size Standards

The Small Business Administration has extended the comment period for two proposed rules that could dramatically reshape federal government contracting by significantly expanding the pool of entities eligible for small business set-aside procurements. With some size standard thresholds proposed to increase as much as tenfold, these changes would fundamentally alter the makeup of the small business contractor base.
United StatesGovernment, Public Sector
Crowell & Moring LLP
Crowell & Moring LLP
Article

U.S.-China Trade Truce Extended Two Months: BIS Affiliates Rule Suspension Follows

The U.S.-China trade truce has been extended through January 10, 2027, pushing back the effective date of the Bureau of Industry and Security's Affiliates Rule. While the suspension delays immediate compliance obligations, the rule remains in place and companies should use this additional time to prepare their compliance programs before the suspension potentially expires.
GlobalInternational Law
Crowell & Moring LLP
Crowell & Moring LLP
Article

White House Announces AI Responsibility Accord, Executive Orders, And Super Intelligence Task Force

The Trump Administration has introduced a voluntary regulatory framework for artificial intelligence through the White House Accord on Super Intelligence, signed by six leading tech companies. This new approach emphasizes corporate self-policing with safety audits and board oversight, while simultaneously rebranding government AI terminology and establishing a new interagency coordination force. How will this light-touch regulatory strategy balance innovation with mounting safety concerns as AI capabilities
United StatesStrategy
Crowell & Moring LLP
Crowell & Moring LLP
Article

The Lindsey Graham Sanctions Act: What Businesses Need To Know About The New Tariffs

President Trump signed the Lindsey O. Graham Sanctioning Russia and Iran Act into law on September 18, 2026, establishing mandatory tariffs of up to 500% on Russian goods and up to 100% on goods from countries that continue to buy Russian energy. The Act targets major importers like China, India, and Turkey, with limited relief mechanisms including natural gas exceptions, presidential waivers, and a 270-day winddown period for entities divesting from Russian operations.
GlobalInternational Law
Crowell & Moring LLP
Crowell & Moring LLP
Article

State AG News: Consumer Fraud And Deceptive Practices (October 1-7, 2026)

State attorneys general across the nation are taking decisive legal action on multiple fronts, from challenging federal fuel economy rollbacks to pursuing pharmaceutical companies over misleading drug claims. This week's enforcement activities reveal coordinated multistate efforts alongside individual state actions targeting consumer protection, national security concerns, and social media platform accountability.
United StatesGovernment, Public Sector
Crowell & Moring LLP
Crowell & Moring LLP
Article

California Follows New York’s Lead In Requiring AI “Synthetic Performer” Disclosures In Advertising

California has enacted SB 1050, requiring advertisers to disclose when AI-generated synthetic performers appear prominently in advertisements starting January 1, 2027. The law mandates clear disclosures using specific language and creates enforcement mechanisms through existing consumer protection statutes, while also imposing obligations on advertising platforms to remove non-compliant content after court orders.
United StatesMedia, Telecoms, IT, Entertainment
Crowell & Moring LLP
Crowell & Moring LLP
Article

Proposed AI Governance Framework: Risk-Mitigation Recommendations For Health Plans

Senator Maria Cantwell has proposed a comprehensive AI governance framework that could fundamentally reshape how health insurance plans deploy artificial intelligence in prior authorization and utilization management. With explicit focus on CMS's WISeR model and requirements for meaningful human oversight, the framework signals potential federal mandates that would require health plans to audit AI systems, ensure transparency in consequential decisions, and maintain accountability for AI-related harms.
United StatesFood, Drugs, Healthcare, Life Sciences
Crowell & Moring LLP
Crowell & Moring LLP
Article

DOT Final Rule Narrows Airline Delay And Cancellation Reporting Obligation Under FAA Reauthorization Act Of 2024

The U.S. Department of Transportation has issued a final rule fundamentally restructuring how airlines report flight delays and cancellations, creating a new reporting category that removes ten specific events from the traditional "Air Carrier" category. This regulatory change, mandated by the FAA Reauthorization Act of 2024 and effective October 2026, will significantly impact how airline performance is measured and perceived by consumers, while reducing carriers' customer service obligations for certain
United StatesTransport
Crowell & Moring LLP
Crowell & Moring LLP
Article

California’s “No Robo Bosses Act” Is Now Law: Human Oversight Required For AI-Driven Discipline And Termination

California's new "No Robo Bosses Act" (SB 947) prohibits employers from relying solely on artificial intelligence or automated decision systems when disciplining or terminating employees, requiring meaningful human review and written notice to affected workers. The law, effective July 1, 2027, establishes strict compliance requirements including corroboration protocols, employee data access rights, and anti-retaliation protections that will fundamentally reshape how California employers deploy AI-driven wor
United StatesEmployment and HR
Crowell & Moring LLP
Crowell & Moring LLP